ultra11y 5.12.0 → 5.13.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.12.0",
+      "version": "5.13.1",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.12.0",
+  "version": "5.13.1",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.12.0",
+  "version": "5.13.1",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.12.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.13.1";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.12.0",
+  "version": "5.13.1",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.12.0";
+var VERSION = "5.13.1";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -39283,6 +39283,12 @@ var AXE_WCAG = {
   bypass: "2.4.1",
   accesskeys: "2.1.1"
 };
+var AXE_DECIDES = {
+  // Text contrast. `color-contrast` is on by default, runs on every text node, and computes
+  // the ratio the criterion states — the one criterion where the automated answer IS the
+  // answer, which is why the local scan tier has always mapped it here.
+  "1.4.3": ["color-contrast"]
+};
 var FALLBACK_SC = "4.1.2";
 function scFromWcagTags(tags) {
   if (!tags) return null;
@@ -48561,6 +48567,7 @@ function foldDoc(acc, doc, graph) {
     const axe = doc.signals?.axe;
     if (axe?.ran) {
       acc.axeRan.add(pageId);
+      for (const sc of Object.keys(AXE_DECIDES)) acc.renderedScs.add(sc);
       for (const f of axeFindings(axe.violations ?? [], doc.file, pageId)) {
         const list = acc.byCriterion.get(f.criteriaId) ?? [];
         list.push(f);
@@ -48589,6 +48596,7 @@ function renderedProves(sc, acc) {
   if (acc.pageIds.size === 0) return false;
   const probed = acc.probedScs.get(sc);
   if (probed && probed.size === acc.pageIds.size) return true;
+  if (AXE_DECIDES[sc] && acc.axeRan.size === acc.pageIds.size) return true;
   const rules = renderedRulesFor(sc);
   if (!rules.length) return false;
   return rules.every((ruleId) => {
@@ -48605,6 +48613,9 @@ function partialProbeReason(sc, acc) {
   return `Probed on ${probed.size} of the ${acc.pageIds.size} pages in scope, so this criterion stays open: conformity here is measured on EVERY page or on none, and the page nobody probed is exactly where the failure would be. Not probed: ${shown.join(", ")}${rest > 0 ? `, and ${rest} more` : ""}.`;
 }
 function renderedProvesReason(sc, acc) {
+  if (AXE_DECIDES[sc] && acc.axeRan.size === acc.pageIds.size) {
+    return `Measured by axe-core on all ${acc.pageIds.size} page(s) in scope \u2014 ${AXE_DECIDES[sc]?.join(", ")} ran in the browser and reported nothing. A page axe had not run on would have kept this criterion open.`;
+  }
   const probed = acc.probedScs.get(sc);
   if (probed && probed.size === acc.pageIds.size) {
     return `Measured in a real browser on all ${acc.pageIds.size} page(s) in scope \u2014 the probe acted on the page (zoom, 320px viewport, text-spacing override, Tab, hover) and observed nothing. A page the probe had not run on would have kept this criterion open.`;
@@ -54362,6 +54373,7 @@ function pageStatus(c2, pageFindings, basis) {
   if (pageFindings.some((f) => !f.advisory)) return "NC";
   if (c2.status === "manual") return "manual";
   if (c2.status === "NA") return "NA";
+  if (c2.inapplicable) return c2.status;
   if (c2.decidedBy === "agent" || c2.decidedBy === "scan") return c2.status;
   if (automatability(c2.id) !== "static") return "manual";
   return basis === "snapshot" ? "C" : "manual";
@@ -54379,13 +54391,17 @@ function derivePages(result, pages) {
     const own = result.findings.filter((f) => f.page === p.id);
     const criteria = result.criteria.map((c2) => {
       const pf = own.filter((f) => f.criteriaId === c2.id);
+      const status = pageStatus(c2, pf, p.basis);
       return {
         id: c2.id,
         guideline: c2.guideline,
-        status: pageStatus(c2, pf, p.basis),
+        status,
         findings: pf,
         ...c2.justification ? { justification: c2.justification } : {},
-        ...c2.decidedBy ? { decidedBy: c2.decidedBy } : {}
+        ...c2.decidedBy ? { decidedBy: c2.decidedBy } : {},
+        // Carried, not recomputed: a finding on THIS page proves the subject exists after all,
+        // and `pageStatus` has already turned that into an NC above.
+        ...c2.inapplicable && status === c2.status ? { inapplicable: true } : {}
       };
     });
     const { rate, decided, total } = pct(criteria);

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.12.0
+  version: 5.13.1
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.12.0";
+var VERSION = "5.13.1";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -39283,6 +39283,12 @@ var AXE_WCAG = {
   bypass: "2.4.1",
   accesskeys: "2.1.1"
 };
+var AXE_DECIDES = {
+  // Text contrast. `color-contrast` is on by default, runs on every text node, and computes
+  // the ratio the criterion states — the one criterion where the automated answer IS the
+  // answer, which is why the local scan tier has always mapped it here.
+  "1.4.3": ["color-contrast"]
+};
 var FALLBACK_SC = "4.1.2";
 function scFromWcagTags(tags) {
   if (!tags) return null;
@@ -48561,6 +48567,7 @@ function foldDoc(acc, doc, graph) {
     const axe = doc.signals?.axe;
     if (axe?.ran) {
       acc.axeRan.add(pageId);
+      for (const sc of Object.keys(AXE_DECIDES)) acc.renderedScs.add(sc);
       for (const f of axeFindings(axe.violations ?? [], doc.file, pageId)) {
         const list = acc.byCriterion.get(f.criteriaId) ?? [];
         list.push(f);
@@ -48589,6 +48596,7 @@ function renderedProves(sc, acc) {
   if (acc.pageIds.size === 0) return false;
   const probed = acc.probedScs.get(sc);
   if (probed && probed.size === acc.pageIds.size) return true;
+  if (AXE_DECIDES[sc] && acc.axeRan.size === acc.pageIds.size) return true;
   const rules = renderedRulesFor(sc);
   if (!rules.length) return false;
   return rules.every((ruleId) => {
@@ -48605,6 +48613,9 @@ function partialProbeReason(sc, acc) {
   return `Probed on ${probed.size} of the ${acc.pageIds.size} pages in scope, so this criterion stays open: conformity here is measured on EVERY page or on none, and the page nobody probed is exactly where the failure would be. Not probed: ${shown.join(", ")}${rest > 0 ? `, and ${rest} more` : ""}.`;
 }
 function renderedProvesReason(sc, acc) {
+  if (AXE_DECIDES[sc] && acc.axeRan.size === acc.pageIds.size) {
+    return `Measured by axe-core on all ${acc.pageIds.size} page(s) in scope \u2014 ${AXE_DECIDES[sc]?.join(", ")} ran in the browser and reported nothing. A page axe had not run on would have kept this criterion open.`;
+  }
   const probed = acc.probedScs.get(sc);
   if (probed && probed.size === acc.pageIds.size) {
     return `Measured in a real browser on all ${acc.pageIds.size} page(s) in scope \u2014 the probe acted on the page (zoom, 320px viewport, text-spacing override, Tab, hover) and observed nothing. A page the probe had not run on would have kept this criterion open.`;
@@ -54362,6 +54373,7 @@ function pageStatus(c2, pageFindings, basis) {
   if (pageFindings.some((f) => !f.advisory)) return "NC";
   if (c2.status === "manual") return "manual";
   if (c2.status === "NA") return "NA";
+  if (c2.inapplicable) return c2.status;
   if (c2.decidedBy === "agent" || c2.decidedBy === "scan") return c2.status;
   if (automatability(c2.id) !== "static") return "manual";
   return basis === "snapshot" ? "C" : "manual";
@@ -54379,13 +54391,17 @@ function derivePages(result, pages) {
     const own = result.findings.filter((f) => f.page === p.id);
     const criteria = result.criteria.map((c2) => {
       const pf = own.filter((f) => f.criteriaId === c2.id);
+      const status = pageStatus(c2, pf, p.basis);
       return {
         id: c2.id,
         guideline: c2.guideline,
-        status: pageStatus(c2, pf, p.basis),
+        status,
         findings: pf,
         ...c2.justification ? { justification: c2.justification } : {},
-        ...c2.decidedBy ? { decidedBy: c2.decidedBy } : {}
+        ...c2.decidedBy ? { decidedBy: c2.decidedBy } : {},
+        // Carried, not recomputed: a finding on THIS page proves the subject exists after all,
+        // and `pageStatus` has already turned that into an NC above.
+        ...c2.inapplicable && status === c2.status ? { inapplicable: true } : {}
       };
     });
     const { rate, decided, total } = pct(criteria);

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.12.0
+  version: 5.13.1
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.12.0";
+var VERSION = "5.13.1";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -39283,6 +39283,12 @@ var AXE_WCAG = {
   bypass: "2.4.1",
   accesskeys: "2.1.1"
 };
+var AXE_DECIDES = {
+  // Text contrast. `color-contrast` is on by default, runs on every text node, and computes
+  // the ratio the criterion states — the one criterion where the automated answer IS the
+  // answer, which is why the local scan tier has always mapped it here.
+  "1.4.3": ["color-contrast"]
+};
 var FALLBACK_SC = "4.1.2";
 function scFromWcagTags(tags) {
   if (!tags) return null;
@@ -48561,6 +48567,7 @@ function foldDoc(acc, doc, graph) {
     const axe = doc.signals?.axe;
     if (axe?.ran) {
       acc.axeRan.add(pageId);
+      for (const sc of Object.keys(AXE_DECIDES)) acc.renderedScs.add(sc);
       for (const f of axeFindings(axe.violations ?? [], doc.file, pageId)) {
         const list = acc.byCriterion.get(f.criteriaId) ?? [];
         list.push(f);
@@ -48589,6 +48596,7 @@ function renderedProves(sc, acc) {
   if (acc.pageIds.size === 0) return false;
   const probed = acc.probedScs.get(sc);
   if (probed && probed.size === acc.pageIds.size) return true;
+  if (AXE_DECIDES[sc] && acc.axeRan.size === acc.pageIds.size) return true;
   const rules = renderedRulesFor(sc);
   if (!rules.length) return false;
   return rules.every((ruleId) => {
@@ -48605,6 +48613,9 @@ function partialProbeReason(sc, acc) {
   return `Probed on ${probed.size} of the ${acc.pageIds.size} pages in scope, so this criterion stays open: conformity here is measured on EVERY page or on none, and the page nobody probed is exactly where the failure would be. Not probed: ${shown.join(", ")}${rest > 0 ? `, and ${rest} more` : ""}.`;
 }
 function renderedProvesReason(sc, acc) {
+  if (AXE_DECIDES[sc] && acc.axeRan.size === acc.pageIds.size) {
+    return `Measured by axe-core on all ${acc.pageIds.size} page(s) in scope \u2014 ${AXE_DECIDES[sc]?.join(", ")} ran in the browser and reported nothing. A page axe had not run on would have kept this criterion open.`;
+  }
   const probed = acc.probedScs.get(sc);
   if (probed && probed.size === acc.pageIds.size) {
     return `Measured in a real browser on all ${acc.pageIds.size} page(s) in scope \u2014 the probe acted on the page (zoom, 320px viewport, text-spacing override, Tab, hover) and observed nothing. A page the probe had not run on would have kept this criterion open.`;
@@ -54362,6 +54373,7 @@ function pageStatus(c2, pageFindings, basis) {
   if (pageFindings.some((f) => !f.advisory)) return "NC";
   if (c2.status === "manual") return "manual";
   if (c2.status === "NA") return "NA";
+  if (c2.inapplicable) return c2.status;
   if (c2.decidedBy === "agent" || c2.decidedBy === "scan") return c2.status;
   if (automatability(c2.id) !== "static") return "manual";
   return basis === "snapshot" ? "C" : "manual";
@@ -54379,13 +54391,17 @@ function derivePages(result, pages) {
     const own = result.findings.filter((f) => f.page === p.id);
     const criteria = result.criteria.map((c2) => {
       const pf = own.filter((f) => f.criteriaId === c2.id);
+      const status = pageStatus(c2, pf, p.basis);
       return {
         id: c2.id,
         guideline: c2.guideline,
-        status: pageStatus(c2, pf, p.basis),
+        status,
         findings: pf,
         ...c2.justification ? { justification: c2.justification } : {},
-        ...c2.decidedBy ? { decidedBy: c2.decidedBy } : {}
+        ...c2.decidedBy ? { decidedBy: c2.decidedBy } : {},
+        // Carried, not recomputed: a finding on THIS page proves the subject exists after all,
+        // and `pageStatus` has already turned that into an NC above.
+        ...c2.inapplicable && status === c2.status ? { inapplicable: true } : {}
       };
     });
     const { rate, decided, total } = pct(criteria);

package/src/audit.ts

@@ -13,7 +13,7 @@ import { attr, elementsByTag, type Doc, type CaptureProvenance } from "./parse/h
 import { CAPTURES_DIR, computeCaptureCoverage, enrichCaptureOrigins, isUnderDir, readCaptureDir, capturesForSources } from "./capture.js";
 import { isFullDocument } from "./rules/rule.js";
 import { renderedRulesFor, renderedRulesRan, renderedTestedScs } from "./rules/rendered.js";
-import { PROBE_SEVERITY, PROBE_WCAG, isAxeAdvisory, scForAxe, severityFromImpact } from "./axe-map.js";
+import { AXE_DECIDES, PROBE_SEVERITY, PROBE_WCAG, isAxeAdvisory, scForAxe, severityFromImpact } from "./axe-map.js";
 import { subjectsAbsent, subjectsForSc, subjectsPresentIn } from "./adjudicate-subjects.js";
 import { runRules } from "./rules/registry.js";
 import { runCrossRules } from "./rules/cross-registry.js";
@@ -526,6 +526,7 @@ export function foldDoc(acc: Accum, doc: Doc, graph?: DepGraph): void {
     const axe = doc.signals?.axe;
     if (axe?.ran) {
       acc.axeRan.add(pageId);
+      for (const sc of Object.keys(AXE_DECIDES)) acc.renderedScs.add(sc);
       for (const f of axeFindings(axe.violations ?? [], doc.file, pageId)) {
         const list = acc.byCriterion.get(f.criteriaId) ?? [];
         list.push(f);
@@ -585,6 +586,9 @@ function renderedProves(sc: string, acc: Accum): boolean {
   // in scope, or nothing.
   const probed = acc.probedScs.get(sc);
   if (probed && probed.size === acc.pageIds.size) return true;
+  // AXE, on every page in scope, for the handful of criteria it is the canonical decider of
+  // (AXE_DECIDES). Same rule as the probes and the digest tier: every page, or nothing.
+  if (AXE_DECIDES[sc] && acc.axeRan.size === acc.pageIds.size) return true;
   const rules = renderedRulesFor(sc);
   if (!rules.length) return false;
   return rules.every((ruleId) => {
@@ -610,6 +614,9 @@ function partialProbeReason(sc: string, acc: Accum): string | undefined {
 }
 
 function renderedProvesReason(sc: string, acc: Accum): string {
+  if (AXE_DECIDES[sc] && acc.axeRan.size === acc.pageIds.size) {
+    return `Measured by axe-core on all ${acc.pageIds.size} page(s) in scope — ${AXE_DECIDES[sc]?.join(", ")} ran in the browser and reported nothing. A page axe had not run on would have kept this criterion open.`;
+  }
   const probed = acc.probedScs.get(sc);
   if (probed && probed.size === acc.pageIds.size) {
     return `Measured in a real browser on all ${acc.pageIds.size} page(s) in scope — the probe acted on the page (zoom, 320px viewport, text-spacing override, Tab, hover) and observed nothing. A page the probe had not run on would have kept this criterion open.`;

package/src/axe-map.ts

@@ -128,6 +128,27 @@ export const AXE_WCAG: Record<string, string> = {
   accesskeys: "2.1.1",
 };
 
+/** THE SUCCESS CRITERIA AN AXE PASS THAT FOUND NOTHING IS ALLOWED TO CLOSE.
+ *
+ *  Deliberately tiny, and deliberately a list rather than a rule. axe REPORTS on dozens of
+ *  success criteria (that is what AXE_WCAG above is for), but reporting on one is not the same
+ *  as being its canonical decider: `color-contrast` computes the very ratio 1.4.3 is written
+ *  in, while axe's ARIA rules cover a slice of 4.1.2 that no clean run can close. Reading the
+ *  second as the first is how a grid fills up with conformities nobody verified.
+ *
+ *  The guardrail around it is in src/audit.ts and is the same one the probes get: the pass must
+ *  have run on EVERY page in scope. A criterion measured on some pages is not a criterion
+ *  measured.
+ *
+ *  Entries are added one at a time, each with the rule that carries it and a reason to trust
+ *  it — never in bulk from axe's tag list. */
+export const AXE_DECIDES: Record<string, readonly string[]> = {
+  // Text contrast. `color-contrast` is on by default, runs on every text node, and computes
+  // the ratio the criterion states — the one criterion where the automated answer IS the
+  // answer, which is why the local scan tier has always mapped it here.
+  "1.4.3": ["color-contrast"],
+};
+
 export const FALLBACK_SC = "4.1.2";
 
 /** Read a WCAG SC from axe's native rule tags. axe tags each rule with `wcag<abc>`

package/src/pages.ts

@@ -165,7 +165,16 @@ function pageStatus(c: CriterionResult, pageFindings: Finding[], basis: PageScop
   // A non-normative recommendation can never flip a criterion to NC — same rule as core.
   if (pageFindings.some((f) => !f.advisory)) return "NC";
   if (c.status === "manual") return "manual"; // the engine cannot decide it anywhere
-  if (c.status === "NA") return "NA"; // not applicable in scope ⇒ not applicable here
+  if (c.status === "NA") return "NA"; // legacy audits only — the engine no longer emits it
+  // NOTHING OF THAT KIND EXISTS ANYWHERE IN SCOPE, so there is none on this page either.
+  //
+  // Checked BEFORE rule 3 below, and it is not an exception to it: rule 3 refuses to conclude
+  // from silence, and this is not silence — it is a scope-wide absence the engine can point at,
+  // carrying the justification that names the subject it looked for. Left to fall through, every
+  // media, table and form criterion came back « à évaluer » on each page while the run-wide grid
+  // had them settled: measured on a three-page sample, 75 of 106 RGAA criteria open per page
+  // against 26 for the run.
+  if (c.inapplicable) return c.status;
 
   // A verdict SOMEBODY RECORDED is not silence, and rule 3 below is only about silence.
   //
@@ -225,13 +234,17 @@ export function derivePages(result: AuditResult, pages: PageScope[]): PageResult
     const own = result.findings.filter((f) => f.page === p.id);
     const criteria: CriterionResult[] = result.criteria.map((c) => {
       const pf = own.filter((f) => f.criteriaId === c.id);
+      const status = pageStatus(c, pf, p.basis);
       return {
         id: c.id,
         guideline: c.guideline,
-        status: pageStatus(c, pf, p.basis),
+        status,
         findings: pf,
         ...(c.justification ? { justification: c.justification } : {}),
         ...(c.decidedBy ? { decidedBy: c.decidedBy } : {}),
+        // Carried, not recomputed: a finding on THIS page proves the subject exists after all,
+        // and `pageStatus` has already turned that into an NC above.
+        ...(c.inapplicable && status === c.status ? { inapplicable: true } : {}),
       };
     });
     const { rate, decided, total } = pct(criteria);

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.12.0";
+export const VERSION = "5.13.1";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,